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= Anti-Patterns: IEEE Floating Point Format 
single Precision: 32 bits total 
e Not accounting for roundoff errors 


— Tests for floating point equality 1 bit 23 bits (with implicit leading 1.) 
e Not handling special values 
e Float used if integer does the job arn 
—- Not always good for “big” numbers Value = (+/-) 1.Mantissa * 2(€xponent-127) 
Sign: O=positive; 1=negative 
m Floating Point Math: Exponent: 127 bias, radix 2 
e Exponent + Mantissa representation value is EXPONENT — 127 
— 32-bit, 64-bit, others on some systems Mantissa: implicit 1. 
e Roundoff errors due to finite number value is 1.MANTISSA (binary) 
of mantissa bits Special zero value: 


e Special values: zero = 0x00000000 


Infinity, Not A Number (NaN), denorms, signed zero : 
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Rounding error due to limited bits 
e Mantissa: 24 bits (implicit leading one) 

- E.g.: all zero mantissa bits >» 1.00000000000000000000000, 
e More than 24 bits of value wont fit 


— Converting int to float to int to float in a chain gives: 
0x72345673 =» 1916032640.0 > 0x72345680 > 1916032640.0 


Rounding error due to imprecise representation 


e IEEE 754 is radix 2, so decimal fractions can be inexact 


— Repeatedly add 0.1 to a 32-bit float and you get.... 
0.1, 0.2, ..., 2.799999, ..., 49.999809, ... ,99.999046 


Floating point comparison pitfall: 


e if (fa == fb) might not match due to rounding error 


— In some cases consider an “approximately equal” test, e.g.: 
if ( fabs( (fa - fb)/fa) < 0.0001 ) 
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= Patriot Missile mishap 
e 1991: Scud kills 28 American (Desert Storm) 
e http://www.fas.org/spp/starwars/gao/im92026.htm 


= What was the root cause? 
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“after about 20 hours, the inaccurate time calculation 
becomes sufficiently large to cause the radar to look 

in the wrong place” 

— “Range gate’ used to look where target is predicted to be next 
— Target track is lost if range gate is wrong, resulting in a miss 
— The incident happened 100 hours after the last system reset 





https://qoo-ql/ 
Patriot designed for aircraft and frequent mobile relocations 
—- Scud missiles travel at Mach 5 (3750 mph); Patriot deployed in fixed location 


Even a small round-off error matters when computing distance = velocity * time 
— Large accumulated base time and high velocity leads to a failure 
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Figure 5: Incorrectly Calculated Range Gate 


= Time is integer 10ths of 


a4. Track Action - Only Range Gated 


Portion of Beam Processed second 
(xy , e Converted to 24-bit 
a a fractional value for 
| \ \g calculation 
fox: , SES TRACKING! e 0.1 seconds is not an 
ae er on. — “even number” = 
NM \y 0.000110011001100110011 
0011001100... 


e At100 hours, resultant 
\ round-off is 0.000000095 
>. \ eae decimal [https://goo.gl/5ik1aul 





= After 100 hours error was 
0.344 seconds = 697 
meters error 

(per GAO report) 
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IEEE Floating Point Format 


m Inf: Infinity 


single Precision: 32 bits total 
e E.g., result when dividing by zero, or overflow 
H 1 bit 23 bits (with implicit leading 1.) 
= Denormalized 
e Number smaller than smallest fraction 8 bits 
— <~10*...~-10°38 No implicit leading 1 in mantissa a... 0x3F800000 


= NaN: “Not a Number’ 


e E.g., square root of negative number Exponent indicates special values: 


-zero: Ox80000000 
e Signaling NaN throws exception Saye: 0x00000000 
e Default is usually “silent” NaN (no exception) t+infinity: Ox7F800000 
= Silent NaN Comparison Pitfall: *NaN Signaling: —0x7F800001... 


: ; +NAN Quiet/Silent : Ox7FCOOOOO... 
e Comparison with NaN is always false 


e if (CurrentSpeed > SpeedLimit) {shutdown} 
— Comparison is false for CurrentSpeed of NaN = no shutdown 
e (NaN == NaN) is also false (surprise!); use isnan() © 2020 Philip Koopman 6 
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Speed-limit violation occurred 
when exceptional input sent 
as speed command 
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The actual failure happened way before the moment of the crash, on the intialization lap. The 
initialization lap is there to take the car from boxes to the start/finish line and the car is driven by a 
human driver during the lap. The intialization lap is a standard procedure by roborace. 


So during this intialization lap something happened which apparently caused the steering control 
Signal to go to NaN and subsequently the steering locked to the maximum value to the right. 
When our car was given a permission to drive, the acceleration command went as normal but the 
steering was locked to the right. We are looking at the log values and can see that our controller 
was trying to steer the car back to the left, but the car did not execute the steering command due 
to a steering lock. The desired trajectory was also good, the car definitely did not plan to go into 
the wall. 


We are not yet sure what was the actual cause, but it seems that its an extremely rare event during 
which there was a short spike in the inputs to the controller. Normally, this spike would have been 
filtered out, but apparently there exists a configuration under which this spike is allowed to 
propagate through the system and we were "very lucky" to collect it during the competitive run. 
We had testing days before and had never experienced this. 


https://www.reddit.com/r/formula1/comments/jk9jrg/ 
ot_roborace_driverless_racecar_drives_straight/ 
October 2020 
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Best Practices for Floating Point peel 
‘ 24 bits 8 bits 


= Use integer math if you can 


e Scaled integer (e.g., 10ths of a second) 
e Binary Coded Decimal (BCD) + radix point ; 


e Fixed point (e.g., value *256) 
= Handle special values 24 8 
e NaN is especially tricky to get right Fixed Point Addition 
(uses normal integer 
m Manage and handle roundoff error addition CPU hardware) 


e Doubles give more bits to work with (53-bit mantissa) 
— But fundamentally, all problems are still there 
e Don't use floating point as an iterator, including time! 
= Comparisons are especially problematic (NaN, roundoff) 
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https://xkcd.com/217/ 





© 2020 Philip Koopman 10 


